steemit / steem

The blockchain for Smart Media Tokens (SMTs) and decentralized applications.
https://steem.com
Other
1.95k stars 790 forks source link

Bug Report: Invalid Account Names #2025

Open AdamCox9 opened 6 years ago

AdamCox9 commented 6 years ago

image.png

Expected behavior

The Steem blockchain should not contain invalid account names. It should at least be possible to unfollow these invalid accounts.

Actual behavior

The blockchain does contain invalid account names.

These account names show up on front-end web apps such as steemit.com:

image.png

A sample account name that is invalid is the empty account name is the null account name which shows above. Some other invalid account names in the blockchain contain invalid characters such as ampersands, etc...

It is impossible to unfollow the null account.

How to reproduce

This bug can be reproduced with any browser and any operating system. A visual reroduction would be to visit profile https://steemit.com/@money-dreamer/followed and notice that the first account followed is the null account.



Posted on Utopian.io - Rewarding Open Source Contributors

mvandeberg commented 6 years ago

Because following accounts is done via custom operation, consensus will never reject the operation, regardless of how invalid it is. There is a bug here, and that is that the account name is not validated in the follow plugin. Nor does it confirm the account itself even exists. If that is added, then regardless of whether the account name is valid or not, it will only be reflected in the plugin state if it is a valid account name and the account exists. The solution is not allowing unfollowing of invalid account names, but preventing invalid account from being followed in the first place.

For the record, the null account is a valid account. It has the name, null. All actual accounts that exist have valid account names. The entry you are showing is display the empty string "", which is not an account on the blockchain.

mvandeberg commented 6 years ago

@roadscape I am inclined not to fix this in steemd because this behavior is going to be done by Hivemind. However, you should be made aware of this so that it won't be a problem in Hivemind.

roadscape commented 6 years ago

Hive performs these checks; agree it's low priority for steem's follow plugin.

AdamCox9 commented 6 years ago

Is there any way to programatically remove this account: https://steemit.com/utopian-io/@money-dreamer/bug-report-invalid-account-names#@money-dreamer/re-money-dreamer-bug-report-invalid-account-names-20180126t021617665z

On Wed, Jan 24, 2018 at 3:32 PM, roadscape notifications@github.com wrote:

Hive performs these checks; agree it's low priority for steem's follow plugin.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/steemit/steem/issues/2025#issuecomment-360264165, or mute the thread https://github.com/notifications/unsubscribe-auth/AArRcbqO4izStxhjsASSsaxWqyNJefe1ks5tN5NkgaJpZM4RqSCy .